From 213dcbfd0a0dab86980a998422440a92cbe4462c Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Tue, 9 Apr 2019 02:40:04 +0000 Subject: [PATCH] qla2x00t-32gbit: Fix a potential out-of-bounds array access Since qla2x00_async_event() may write mb[7], change the size of the mb[] array from 4 into 8. git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@8176 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- qla2x00t-32gbit/qla_isr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/qla2x00t-32gbit/qla_isr.c b/qla2x00t-32gbit/qla_isr.c index 963d5729d..6bcfd6c8d 100644 --- a/qla2x00t-32gbit/qla_isr.c +++ b/qla2x00t-32gbit/qla_isr.c @@ -53,7 +53,7 @@ qla2100_intr_handler(int irq, void *dev_id) int status; unsigned long iter; uint16_t hccr; - uint16_t mb[4]; + uint16_t mb[8]; struct rsp_que *rsp; unsigned long flags; @@ -172,7 +172,7 @@ qla2300_intr_handler(int irq, void *dev_id) unsigned long iter; uint32_t stat; uint16_t hccr; - uint16_t mb[4]; + uint16_t mb[8]; struct rsp_que *rsp; struct qla_hw_data *ha; unsigned long flags;